Re: FYI LinkedIn passwords hacked

2012-06-11 Thread R.S.
W dniu 2012-06-10 22:37, Andy Wood pisze: On Fri, 8 Jun 2012 22:48:50 +0200, R.S.r.skoru...@snip.com.pl wrote: [snipped] I am quite prepared to accept that mainframe workers would know that it is not a good idea to reuse passwords in that way. However, that was not my point when I said that

Re: FYI LinkedIn passwords hacked

2012-06-10 Thread Andy Wood
On Fri, 8 Jun 2012 22:48:50 +0200, R.S. r.skoru...@bremultibank.com.pl wrote: . . . So, a user provides new password, the password is hashed (i.e. using SHA function) and the hash is stored. The result: you can compare hash from databse with hash of password-provided-during-logon. You cannot

Re: FYI LinkedIn passwords hacked

2012-06-08 Thread Clark Morris
On 7 Jun 2012 14:28:43 -0700, in bit.listserv.ibm-main you wrote: On Thu, 7 Jun 2012 19:55:51 +0200, R.S. r.skoru...@bremultibank.com.pl wrote: Having password or not is not matter of topic of IBM-MAIN. There are really a lot of things which do have passwords and are absolutely unrelated to

Re: FYI LinkedIn passwords hacked

2012-06-08 Thread Phil Smith
Clark Morris wrote: Would you mind explaining further what unsalted passwords are? It's not unsalted passwords, it's unsalted hashes. The salt means added entropy (randomness). For example, when the password for clark.mor...@company.commailto:clark.mor...@company.com is hashed, you might add

Re: FYI LinkedIn passwords hacked

2012-06-08 Thread Bill Fairchild
LinkedIn passwords hacked On 7 Jun 2012 14:28:43 -0700, in bit.listserv.ibm-main you wrote: On Thu, 7 Jun 2012 19:55:51 +0200, R.S. r.skoru...@bremultibank.com.pl wrote: Having password or not is not matter of topic of IBM-MAIN. There are really a lot of things which do have passwords

Re: FYI LinkedIn passwords hacked

2012-06-08 Thread R.S.
W dniu 2012-06-08 22:02, Clark Morris pisze: On 7 Jun 2012 14:28:43 -0700, in bit.listserv.ibm-main you wrote: [...] Yet some smug mainframe workers could learn something from this. Such as, storing hashed but unsalted passwords is not such a good idea (and, yes, I have seen that done on a

Re: FYI LinkedIn passwords hacked

2012-06-07 Thread Hal Merritt
Hammers, football games, and panties don't usualy have passwords. LinkedIn isn't as pervasive as Yahoo, but does serve a higher value clientel, at least in the US. Major portals such as Yahoo, Google+, Hotmail, etc all do and I would say that getting the word out about a major breech is a

Re: FYI LinkedIn passwords hacked

2012-06-07 Thread R.S.
Having password or not is not matter of topic of IBM-MAIN. There are really a lot of things which do have passwords and are absolutely unrelated to mainframes. We are here to discuss mainframe issues, not password problems on popular portal(s). However in case of security breach on IBM.com

Re: FYI LinkedIn passwords hacked

2012-06-07 Thread Andy Wood
On Thu, 7 Jun 2012 19:55:51 +0200, R.S. r.skoru...@bremultibank.com.pl wrote: Having password or not is not matter of topic of IBM-MAIN. There are really a lot of things which do have passwords and are absolutely unrelated to mainframes. We are here to discuss mainframe issues, not password